Vendor CVEs

Jenkins Project

All CVEs

1,869 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-34802	Jenkins Project Rocketchat Notifier	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34801	Jenkins Project Build Notifications	Med	0.28	4.3	0.00	Jun 30, 2022	Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2022-34800	Jenkins Project Build Notifications	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34799	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34798	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34797	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34796	Jenkins Project Deployment Dashboard	Med	0.28	4.3	0.01	Jun 30, 2022	A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34785	Jenkins Project build-metrics	Med	0.28	4.3	0.01	Jun 30, 2022	Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVE-2022-34782	Jenkins Project Requests	Med	0.28	4.3	0.01	Jun 30, 2022	An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVE-2022-34778	Jenkins Project Testng Results	Med	0.28	5.4	0.01	Jun 30, 2022	Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to…
CVE-2022-34208	Jenkins Project Beaker Builder	Med	0.28	4.3	0.01	Jun 23, 2022	A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34206	Jenkins Project Jianliao Notification	Med	0.28	4.3	0.01	Jun 23, 2022	A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34204	Jenkins Project Easyqa	Med	0.28	4.3	0.01	Jun 23, 2022	A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2022-34197	Jenkins Project Sauce Ondemand	Med	0.28	5.4	0.01	Jun 23, 2022	Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34191	Jenkins Project NS-ND Integration Performance Publisher Plugin	Med	0.28	5.4	0.01	Jun 23, 2022	Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34188	Jenkins Project Hidden Parameter	Med	0.28	5.4	0.01	Jun 23, 2022	Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34170	Jenkins Project Jenkins	Med	0.28	5.4	0.01	Jun 23, 2022	In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability…
CVE-2022-30957	Jenkins Project SSH	Med	0.28	4.3	0.01	May 17, 2022	A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-30949	Jenkins Project Repo	Med	0.28	5.3	0.01	May 17, 2022	Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2022-29049	Jenkins Project Promoted Builds	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.
CVE-2022-29047	Jenkins Project Pipeline: Shared Groovy Libraries Plugin	Med	0.28	5.3	0.01	Apr 12, 2022	Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the…
CVE-2022-29044	Jenkins Project Node And Label Parameter	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29043	Jenkins Project Mask Passwords	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29041	Jenkins Project Jira	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with…
CVE-2022-29039	Jenkins Project Gerrit Trigger	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29037	Jenkins Project Cvs	Med	0.28	5.4	0.01	Apr 12, 2022	Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-28152	Jenkins Project Job And Node Ownership	Med	0.28	4.3	0.01	Mar 29, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.
CVE-2022-28151	Jenkins Project Job And Node Ownership	Med	0.28	4.3	0.01	Mar 29, 2022	A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.
CVE-2022-28145	Jenkins Project Continuous Integration With Toad Edge	Med	0.28	5.4	0.01	Mar 29, 2022	Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control…
CVE-2022-28138	Jenkins Project Rocketchat Notifier	Med	0.28	4.3	0.01	Mar 29, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
CVE-2022-27218	Jenkins Project Incapptic Connect Uploader	Med	0.28	4.3	0.01	Mar 15, 2022	Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-27215	Jenkins Project Release Helper	Med	0.28	4.3	0.01	Mar 15, 2022	A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27214	Jenkins Project Release Helper	Med	0.28	4.3	0.00	Mar 15, 2022	A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27205	Jenkins Project Extended Choice Parameter	Med	0.28	4.3	0.01	Mar 15, 2022	A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-27199	Jenkins Project Cloudbees AWS Credentials	Med	0.28	4.3	0.01	Mar 15, 2022	A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVE-2022-27197	Jenkins Project Dashboard View	Med	0.28	5.4	0.01	Mar 15, 2022	Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
CVE-2022-27196	Jenkins Project Favorite	Med	0.28	5.4	0.01	Mar 15, 2022	Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
CVE-2022-25191	Jenkins Project Agent Server Parameter	Med	0.28	5.4	0.01	Feb 15, 2022	Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25189	Jenkins Project Custom Checkbox Parameter	Med	0.28	5.4	0.01	Feb 15, 2022	Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25185	Jenkins Project Generic Webhook Trigger	Med	0.28	5.4	0.01	Feb 15, 2022	Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-23115	Jenkins Project Batch Task	Med	0.28	5.4	0.01	Jan 12, 2022	Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task.
CVE-2022-23106	Jenkins Project Configuration As Code	Med	0.28	5.3	0.01	Jan 12, 2022	Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
CVE-2021-21700	Jenkins Project Scriptler	Med	0.28	5.4	0.01	Nov 12, 2021	Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.
CVE-2021-21661	Jenkins Project Kubernetes	Med	0.28	4.3	0.02	Jun 10, 2021	Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2021-21660	Jenkins Project Markdown Formatter	Med	0.28	5.4	0.01	May 25, 2021	Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.
CVE-2021-21653	Jenkins Project Xray Test Management For Jira	Med	0.28	4.3	0.01	May 11, 2021	Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2021-21644	Jenkins Project Config File Provider Plugin	Med	0.28	5.4	0.01	Apr 21, 2021	A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.
CVE-2021-21636	Jenkins Project Team Foundation Server	Med	0.28	4.3	0.01	Mar 30, 2021	A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
CVE-2021-21626	Jenkins Project Warnings Next Generation	Med	0.28	4.3	0.01	Mar 18, 2021	Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file…
CVE-2021-21621	Jenkins Project Support Core	Med	0.28	5.3	0.01	Feb 24, 2021	Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configurations.

CVE-2022-34802MedJun 30, 2022
Jenkins Project
Rocketchat Notifier
risk 0.28cvss 4.3epss 0.01
Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34801MedJun 30, 2022
Jenkins Project
Build Notifications
risk 0.28cvss 4.3epss 0.00
Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVE-2022-34800MedJun 30, 2022
Jenkins Project
Build Notifications
risk 0.28cvss 4.3epss 0.01
Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34799MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE-2022-34798MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34797MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
CVE-2022-34796MedJun 30, 2022
Jenkins Project
Deployment Dashboard
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-34785MedJun 30, 2022
Jenkins Project
build-metrics
risk 0.28cvss 4.3epss 0.01
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVE-2022-34782MedJun 30, 2022
Jenkins Project
Requests
risk 0.28cvss 4.3epss 0.01
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests.
CVE-2022-34778MedJun 30, 2022
Jenkins Project
Testng Results
risk 0.28cvss 5.4epss 0.01
Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain job-level options are set, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to…
CVE-2022-34208MedJun 23, 2022
Jenkins Project
Beaker Builder
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-34206MedJun 23, 2022
Jenkins Project
Jianliao Notification
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
CVE-2022-34204MedJun 23, 2022
Jenkins Project
Easyqa
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVE-2022-34197MedJun 23, 2022
Jenkins Project
Sauce Ondemand
risk 0.28cvss 5.4epss 0.01
Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34191MedJun 23, 2022
Jenkins Project
NS-ND Integration Performance Publisher Plugin
risk 0.28cvss 5.4epss 0.01
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34188MedJun 23, 2022
Jenkins Project
Hidden Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-34170MedJun 23, 2022
Jenkins Project
Jenkins
risk 0.28cvss 5.4epss 0.01
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability…
CVE-2022-30957MedMay 17, 2022
Jenkins Project
SSH
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-30949MedMay 17, 2022
Jenkins Project
Repo
risk 0.28cvss 5.3epss 0.01
Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2022-29049MedApr 12, 2022
Jenkins Project
Promoted Builds
risk 0.28cvss 5.4epss 0.01
Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.
CVE-2022-29047MedApr 12, 2022
Jenkins Project
Pipeline: Shared Groovy Libraries Plugin
risk 0.28cvss 5.3epss 0.01
Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the…
CVE-2022-29044MedApr 12, 2022
Jenkins Project
Node And Label Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29043MedApr 12, 2022
Jenkins Project
Mask Passwords
risk 0.28cvss 5.4epss 0.01
Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29041MedApr 12, 2022
Jenkins Project
Jira
risk 0.28cvss 5.4epss 0.01
Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with…
CVE-2022-29039MedApr 12, 2022
Jenkins Project
Gerrit Trigger
risk 0.28cvss 5.4epss 0.01
Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-29037MedApr 12, 2022
Jenkins Project
Cvs
risk 0.28cvss 5.4epss 0.01
Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-28152MedMar 29, 2022
Jenkins Project
Job And Node Ownership
risk 0.28cvss 4.3epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.
CVE-2022-28151MedMar 29, 2022
Jenkins Project
Job And Node Ownership
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.
CVE-2022-28145MedMar 29, 2022
Jenkins Project
Continuous Integration With Toad Edge
risk 0.28cvss 5.4epss 0.01
Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control…
CVE-2022-28138MedMar 29, 2022
Jenkins Project
Rocketchat Notifier
risk 0.28cvss 4.3epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
CVE-2022-27218MedMar 15, 2022
Jenkins Project
Incapptic Connect Uploader
risk 0.28cvss 4.3epss 0.01
Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2022-27215MedMar 15, 2022
Jenkins Project
Release Helper
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27214MedMar 15, 2022
Jenkins Project
Release Helper
risk 0.28cvss 4.3epss 0.00
A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
CVE-2022-27205MedMar 15, 2022
Jenkins Project
Extended Choice Parameter
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-27199MedMar 15, 2022
Jenkins Project
Cloudbees AWS Credentials
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
CVE-2022-27197MedMar 15, 2022
Jenkins Project
Dashboard View
risk 0.28cvss 5.4epss 0.01
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
CVE-2022-27196MedMar 15, 2022
Jenkins Project
Favorite
risk 0.28cvss 5.4epss 0.01
Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
CVE-2022-25191MedFeb 15, 2022
Jenkins Project
Agent Server Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25189MedFeb 15, 2022
Jenkins Project
Custom Checkbox Parameter
risk 0.28cvss 5.4epss 0.01
Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-25185MedFeb 15, 2022
Jenkins Project
Generic Webhook Trigger
risk 0.28cvss 5.4epss 0.01
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2022-23115MedJan 12, 2022
Jenkins Project
Batch Task
risk 0.28cvss 5.4epss 0.01
Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task.
CVE-2022-23106MedJan 12, 2022
Jenkins Project
Configuration As Code
risk 0.28cvss 5.3epss 0.01
Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
CVE-2021-21700MedNov 12, 2021
Jenkins Project
Scriptler
risk 0.28cvss 5.4epss 0.01
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.
CVE-2021-21661MedJun 10, 2021
Jenkins Project
Kubernetes
risk 0.28cvss 4.3epss 0.02
Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2021-21660MedMay 25, 2021
Jenkins Project
Markdown Formatter
risk 0.28cvss 5.4epss 0.01
Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.
CVE-2021-21653MedMay 11, 2021
Jenkins Project
Xray Test Management For Jira
risk 0.28cvss 4.3epss 0.01
Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2021-21644MedApr 21, 2021
Jenkins Project
Config File Provider Plugin
risk 0.28cvss 5.4epss 0.01
A cross-site request forgery (CSRF) vulnerability in Jenkins Config File Provider Plugin 3.7.0 and earlier allows attackers to delete configuration files corresponding to an attacker-specified ID.
CVE-2021-21636MedMar 30, 2021
Jenkins Project
Team Foundation Server
risk 0.28cvss 4.3epss 0.01
A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
CVE-2021-21626MedMar 18, 2021
Jenkins Project
Warnings Next Generation
risk 0.28cvss 4.3epss 0.01
Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file…
CVE-2021-21621MedFeb 24, 2021
Jenkins Project
Support Core
risk 0.28cvss 5.3epss 0.01
Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configurations.

Page 27 of 38